CVE-2023-53280
BaseFortify
Publication date: 2025-09-16
Last updated on: 2025-12-02
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 4.14 (inc) to 5.4.251 (exc) |
| linux | linux_kernel | From 5.5 (inc) to 5.10.188 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.121 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.40 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.4.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a flaw in the Linux kernel's qla2xxx driver where an uninitialized wait queue (nvme_ls_waitq) is used. Specifically, when the function qla2x00_start_sp(sp) returns an error code EGAIN, the system attempts to wake up this uninitialized wait queue, leading to a kernel NULL pointer dereference and causing a system crash.
How can this vulnerability impact me? :
This vulnerability can cause a system crash (kernel panic) on affected Linux systems using the qla2xxx driver. This can lead to denial of service as the system becomes unstable or unavailable until rebooted or fixed.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for kernel crash logs or oops messages related to the qla2xxx driver, specifically looking for errors such as 'qla2x00_start_sp failed = 11' and kernel NULL pointer dereference messages involving nvme_ls_waitq. Checking system logs (e.g., using 'dmesg' or 'journalctl -k') for these specific error patterns can help identify if the vulnerability is being triggered.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where the qla2xxx driver has removed the unused nvme_ls_waitq wait queue, which fixes the system crash issue. Until an update is applied, monitoring for related kernel crashes and avoiding workloads that trigger qla2x00_start_sp errors may reduce risk.